Admittedly this is likely the main reason GPG isn't more common place because of the complexity. This is the overview: Developer generates a private/public ke

Admittedly this is likely the main reason GPG isn't more common place because of the complexity. This is the overview: Developer generates a private/public key they use for all of their projects. You import their public key once - you can verify this from their github, twitter, etc but that's optional. They can sign a file with their key. You can check this signature against their public key. This will guarantee the file was signed by using that key and is unmodified. If someone hijacks the website after this point and signs the new downloads with their own key - then you will be able to see it's invalid. If you manually verify the key then you'll know your initial download is valid - if you trust on first use then you at least know all future files signed from that developer with that cert are valid. They also are effectively a hash for file integrity. tl;dr - hashes tell you if a file is changed. Signatures tell you if the file is changed, and who the person that made the file is.